KZT, fix: Preserve callback control-flow boundaries

[baibaidashixiong]

Summary

Preserve KZT callback control flow when translated code begins with a fixed LoongArch branch, and limit callback-sentinel exits to RunFunctionWithState so ordinary guest INT3 events follow the guest signal path.

• Decode complete b/bl and pcaddu18i/jirl destinations, restore the required base/link registers, and track installation by TB, code pointer, flush generation, callback, and guest address.
• Keep every one-word source branch patched with a one-word b. For a distant callback bridge, allocate a near entry relay and leave the second instruction at its original PC. This preserves PC-relative instructions and the original BL return address, and removes the continuation return jump that overwrote live t0 values.
• Keep published relay slots immutable, reclaim pages after their TB generation is flushed, and leave source code unchanged if a near relay cannot be allocated. Failed installation remains retryable.
• Hold conflicting temporary registers until the fixed bridge obtains one distinct from both the restored base and link registers.
• Register the callback harness in lat-pr-fast. Check execution results for PCADDI, a relative second branch, and a second instruction that writes t0 followed by a read. Cover allocation failure/retry, relay lifetime, and the earlier decoder/bridge/lifecycle regressions.

Validation

Candidate: 48763285d48, rebased onto 182d9f195ec. The five existing commits retain their authors and DCO trailers; the continuation repair is a separate sixth commit.

On a LoongArch host with GCC 14.2 and UBSan:

python3 tests/unit/kzt/test-kzt-callback-branch.py . --cc gcc

Passed portable execution-model and lifecycle checks, production bridge register-allocation checks, and 24 native instruction-execution cases covering forward/backward, near/far, B/BL, and the three continuation cases. Native execution uses the production installer and jump encoders with a minimal callback-body substitute; it is not full application acceptance. The reviewed head failed all three continuation cases on the same host.

A dual-guest test configuration was created with:

mkdir build-tests
cd build-tests
../configure --target-list=x86_64-linux-user,i386-linux-user \
  --enable-latx --enable-latx-avx-opt --enable-tests --disable-werror \
  --optimize-O1 --extra-ldflags=-ldl --disable-docs \
  --meson=meson --with-git-submodules=ignore
meson test --suite lat-pr-fast --print-errorlogs

Both product binaries built successfully, and the complete lat-pr-fast suite passed 47/47 on the rebased candidate. The portable callback harness also passed locally with Clang and UBSan.

The KZT configuration uses the same configure options, with --target-list=x86_64-linux-user --enable-kzt. Validation commands:

ninja -C build-kzt -j8 latx-x86_64 tests/unit/test-kzt-callback-fpr
meson test -C build-kzt --no-rebuild \
  test-kzt-callback-branch test-kzt-elf-lifecycle test-kzt-callback-fpr \
  --print-errorlogs
meson test -C build-kzt --no-rebuild --suite latx-integration \
  test-x11-xcb-wrapper-abi test-x11-async-bridge test-int3-sigtrap-rip \
  --print-errorlogs

KZT product linking succeeded and the three focused tests passed 3/3. All three integration tests exited 77: the X11 tests lack the x86-64 guest sysroot, and the INT3 test lacks Clang to build its guest. These are skips, not passes.

The full KZT-enabled test build has a separate test-latx-aot-segment-unmap link dependency on kzt_wine_bridge, addressed separately in #509. No application acceptance is claimed for this final candidate. Local checks are separate from hosted CI.

Checklist

• Read CONTRIBUTING.md.
• Every commit contains a DCO sign-off.
• Build/test results and remaining validation gates are recorded above.